Digital information transfer system having integrity check

ABSTRACT

A digital information transfer system for selecting and then enabling a remote utilization device by a digital address including means for assuring system integrity. A selector is actuated to energize one comparator input and generate a unique digital address to enable one utilization device. The digital complement of the enabled utilization device address is generated and transmitted to a decoder at the selector. If the correct utilization device is enabled, the digital complement is decoded to energize the second comparator input. Simultaneous energization of two comparator inputs enables means for operating the utilization device. If a system malfunction occurs, inputs to two different comparators are energized, thereby blocking further operation.

United States Patent [72] Inventor Ralph A. Benson PrimaryExaminer-Harold l. Pitts Peabody, Mass. Attorneys--William S. Wolfe andGerald R, Woods 21 Appl. No. 756,995 [22] Filed Sept. 3, 1968 [45]Patented May 4, 1971 [73] Assignee General Electric Company [54] DIGITALINFORMATION T SFER SYSTEM ABSTRACT: A digital information transfersystem for select- HAVING INTEGRITY CHECK mg and then enabling a remoteutilization device by a digital 14 Claims, 7 Drawing Figs.

address includ ng means for assuring system integrity. A selec- [52] US.Cl. 340/163, to is actuated to energize one comparator input andgenerate 15 340/167 a unique digital address to enable one utilizationdevice. The [5 1] Int. Cl "04g U00, digital complement of the enabledutilization device address is I H04g 3/ g generated and transmitted to adecoder at the selector. if the Fleld 0f l 63, correct utilizationdevice is enabled the complement is 151, 147 decoded to energize thesecond comparator input. Simultane- 56 R f d ous energization of twocomparator inputs enables means for 1 e emnoes operating the utilizationdevice. If a system malfunction oc- UNITED STATES PATENTS curs, inputsto two different comparators are energized, 2,944,247 7/1960 Breese 340/1 63 thereby blocking further operation.

REMOTE STATION-I l3 POINT SELECTOR-I2 i I I T9 1 MASTER couuou u so m Ii .11

F I j comm) M a I T2 24 I I 35 l i l LATCH 2 PARALLEL- PT.2 POINT I6 a1A SERIAL 1 TRANSCEIVER I] :E CONVERTER 5 F COIPARATOR H l e L35 I I L iFROM OTHER I POINT ENCODERS PI 9 LATCH I "l E s i iiiiiiil i I A ADDRESSmrzrggn POINT W I i i ENCODER coupiiviim T l nrconsns Pomr monrss. T1.llPLl'lEllT l vrcoom more I ma I T COMPLEMENT MASTER STATION I I E I orDER I 1 OTHER REIIOTE STATION l l POINT SELECTORS I PATENTED MAY 4 I97!SHEET 2 [IF 7 w s a; 555 29%;; @2228 5 I25 m m m 555 I 22%;; @228 v a m55 a C 5:2 55m 225;; @5528 T: 55

$ 222 3E8 Eat Tim:

NQE

Q 2228 502mm INVENTOR RALPH A. BENSON flM ATTORNEY U QI "PATENTED HAY4197! SHEET 0F 7 E85 m 55:38 h a INVENTOR RALPH A. BENSON BY 2 a sATTORNEY PATENTEU HAY 4 ml SHEET 5 0F 7 REMOTE STATION ADDRESS DECODER45 AND CONPLEN T ENCODER 6| INVENTOR RALPH A. BENSON BY E i ATTORNEY'PATENTED MAY 4 |97| SHEET 5 OF 7 I 1 I I INVENTOR RALPH A. BENSONATTORNEY nrcrrars TNFORMATION TRANSFER SYSTEM HAVING macnrrv CHECK.

BACKGROUND OF THE INVENTION This invention is directed to digitalinformation transfer systems and more specifically to such systemsrequiring high trolled from a central location. Both specific examplesutilize a digital message which selects a utilization device foractuation.

The need for high security message transmission is evident in theseapplications. If a malfunction occurs, without safeguards, it would bepossible for the wrong utilization device to be selected and actuated.There are several diverse schemes which assure message integrity, andparity is the most common. Variations have been developed to assure thatno digital bits are lost or added to a message. However, none of theschemes assures the overall operating security of the system.

Therefore, in the prior art, parity has been complemented with acheck-back system. For example, when a double railsystem has beenincorportated in a supervisory control system, a message is received bya transmitter and then sent over one message handling and processingmeans asthe message and-its complement. After the message is received ata remote location a check-back message and its complement are generatedand processed by a second message handling and processing means.However, this procedure is usually incorporated at the remote station orat the master station, but not between these stations.

Two complete message handling and processing means are required in thedouble rail system. Further, a complete systems check is not attainedbecause correct transmission can occur even though the system mightmalfunction.

Therefore, it is an object of this invention to provide a digitalmessage transfer system which assures high security messagetransmission.

Another object of this invention is to provide a digital messagetransfer system including means for checking the entire system.

Another object of this invention is to provide a digital messagetransfer system adapted for utilizing single rail logic.

Yet another object of this invention is to provide a digital messagetransfer system wherein the number of interconnecting conductors isreduced without loss of message security.

SUMMARY In accordance with one aspect of this invention means areinitiated to generate a digital address which is transmitted "fromamaster station to a remote station to enable one utilization device.When a utilization device is enabled, its digital address iscomplemented and is transmitted to the master station may be obtained byreferring to the following detailed description taken in conjunctionwith the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is the schematic diagram of anembodiment of a supervisory system master station adapted to utilizethis invention;

FIG. 2 is a schematic diagram of an embodiment of a supervisory systemremote station adapted to utilize this invention;

FIG. 3 is a schematic diagram of one embodiment of the master stationpoint selector and point address complement decoder shown in FIG. I;

FIG. 4 is a schematic diagram of one embodiment of a remote pointincluding a latch, command switch and utilization circuit shown in FIG.2;

FIG. 5 is a schematic diagram of one embodiment of the address decoderand complement encoder adapted for use in the remote station in FIG. 2;

FIG. 6 is a schematic diagram of one embodiment of the remote pointaddress complement encoder adapted for use in the remote station of FIG.2; and

FIG. 7 is a schematic diagram of one embodiment of a remote stationaddress complement decoder adapted for use in the master station of FIG.I.

, DESCRIPTION OF AN ILLUSTRATIVE EMBODIMENT The following discussion ofa digital information transfer system is presented in terms of aspecific embodiment of a supervisory control system. Only one remotestation and a few associated control points are disclosed. The actualnumber of remote stations and control points in each remote station mayvary in actual applications. Means for adding remote stations andcontrol points will be discussed hereinafter.

In the following discussion like numerals refer to like elementsthroughout. In FIG. 1 a supervisory control system master station isdivided into two portions. A MASTER COM- MON 11 including circuitry forselecting diverse actuating and readout circuits is illustrated with aPOINT SELECTOR 12 for a first remote station, REMOTE STATION-l as anexample. The MASTER COMMON 11 also includes circuitry for processing andhandling digital messages such as COM- MON BUSSES l3 tied to aPARALLEL-SERIAL CON- VERTER 14 which converts information in parallelformat on the COMMON BUSSES 13 to serial form for transmission by aTRANSCEIVER 15 onto a data transmission means 16 such as an electricalconductor or microwave transmission system. The TRANSCEIVER 15 and thePARALLEL-SERIAL CON- VERTER 14 also respond to incoming signals on thetransmission means 16 to place the information onto the COMMON BUSSES 13in parallelform. The entire system is usually under control of aprogrammer which provides a series of timing pulses. As means forgenerating such timing pulse sequences are known to those of ordinaryskill in the art, the various FIGS. merely show timing pulse inputswhere necessary. Other circuits may also be tied to the COMMON BUSSES l3and be controlled by the programmer. These circuits normally do notrequire the high degree of security provided by this invention.Therefore, this invention is described only in terms of point selectionwhere a control action is to be commanded. Also in the MASTER COMMON 11is a REMOTE STATION ADDRESS COMPLEMENT DECODER 20. A COMMAND ENCODER 21is responsive to switches 22 and 23 to generate an appropriate commandsignal and place it on the COMMON BUSSES 13 in conjunction with theprogrammer.

The POINT SELECTOR 12 includes a plurality of circuits for each remotestation; all point selectors are connected to the COMMON BUSSES 13 at24. Branch busses 25 interconnect POINT SELECTOR 12 which the pointselectors for other remote stations. Each point selector is similar sothe POINT SELECTOR l2 for REMOTE STATION-l is the only detailed circuit.Each remote station may include a plurality of control points. In FIG. 1three points are shown and designated as PT-I, P'T-Z and PT-n. PT-l hasa point select switch 30 which energizes a latch 31 and one input of amaster 32. Similarly, rm: has azpoint' select switch 33 and alatch 34;and P'T rt, a point select switch 35 and a latch 36. Each latch isindividually connected to one input of the POINT ENCODER 32. When thePOINT EN- CODER' 32 is activated by a point select switch, it energizesone of a pluralityof inputs to the REMOTE STATION AD- DRESS ENCODER 17and acts in conjunction with the COM- MAND ENCODER 21 to select andactuate a specific utilization device such as a circuit breaker or'apipeline valve by generating a unique digital address and command.

For example, assume during an operation that the point select switch 30is depressed thereby grounding the input of the latch 31 and one inputof the POINT ENCODER 32. The programmer starts a point selection andcontrol sequence to produce a series of timing pulses. Simultaneously,the POINT ENCODER 32 causes the REMOTE STATION ADDRESS ENCODER 17 to beenergized to provide the address for REMOTE STATION-I. A first timingpulse T1 opens the gate of the REMOTE STATION ADDRESS ENCODER 17 toplace the remote station address on the COMMON BUSSES 13. This addressis processed by the PARALLEL-SERIAL CONVERTER l4 and transmitted after async pulse is generated thereby. Timing pulse T2 causes the signalgenerated by POINT ENCODER 32 to be impressed on the COMMON BUSSES 13immediately after the remote station address has been removed. The POINTENCODER 32 also may be programmed to generate a command signal. As aresult, a digital message of the following format could be seriallytransmitted to the remote station:

Sync Bit 1 bit Remote Address Command bits Point Address S-bits LogicParity 5 bits 5 bits This is an example of a message sent by.a systemhaving can be obtained by cascading the points. For example, I00

points could be controlled with a two-digit, binary-coded decimal pointaddress, by properly controlling the timing pulses.

FIG. 2 illustrates a portion of REMOTE STATION-J. The message from themaster station is received in serial form on the transmission means 16by a REMOTE TRANSCEIVER and is converted to parallel form by aPARALLEL-SERIAL CONVERTER 41 to be impressed upon remote station COM-MON BUSSES 42 for transmission to various circuits in the REMOTE COMMON43 and the REMOTE CONTROL POINTS 44. Each remote station also includes atiming pulse generating programmer energized by the sync bit. If parityis included in the message, the programmer initially acts in conjunctionwith the REMOTE TRANSCEIVER 40 and the PARALLEL-SERIAL CONVERTER 41 tocomplete a parity check. lfa parity check is obtained, the message istransferred onto COMMON BUSSES 42 in synchronisrn with the timingpulses. A timing pulse T3 permits the remote station address to beapplied to a REMUI" E STATION ADDRESS DECODER 45. When the timing pulseT3 is applied to the gate and the address is accepted, a signal istransferred to a REMOTE POINT ADDRESS DECODER 46. Simultaneously with atiming pulse T4, the point address on the COMMON BUSSES 42 is read intothe REMOTE POINT ADDRESS DECODER 46 which responds by energizing one ofa plurality of outputs individually connected to enable a singleutilization device control means. A first control point, designatedPT-l,

includes a latch 47 and a command switch 50. Similarly, a latch 52 is,coupled Ito the REMOTE POINT ADDRESS DECODER 46 for controlling a'utilizationdevice 53 in conjunction with a command switch 54 at PT-Z. APT n utilization device 55 is controlled in response to signals from alatch 56 and a command switch 57. Each of the latches 47, 52 and 56 isalso individually connected to energize one of a plurality of inputs toa REMOTE POINT ADDRESS COMPLEMENT ENCODER 60. Whenever one latch, suchas latch 47, is energized thereby enabling the control means, a uniquecode is generated by the REMOTE POINT ADDRESS COMPLE- MENT ENCODER 60.If the encoded point address was that of the latch 47, then inaccordance with this invention, the unique code is the complement of thepoint address.

After this sequence has been completed, T5 is applied to the gate of aREMOTE STATION ADDRESS COMPLEMENT ENCODER 61 to apply the remote stationaddress complement to the remote station COMMON BUSSES 42 fortransmission back tothe master station. This is followed by a timingpulse T6 to the gate of the REMOTE POINT ADDRESS COMPLEMENT ENCODER 60so that the remote point address complement is transferred onto theremote COMMON BUSSES 42. T5 and T6 may be delayed to pennit a commandresponse to be generated by other code generating means connected to theremote station COMMON BUSSES 42. Therefore, a message is transmittedacross the transmission means I6 which might have the following format:

Sync I bit Command Response 5 bits Remote Address ComplementPoint'Address Complement Logic Parity 8 5 bits Means may also beprovided for generating additional pari- 5 bits 5 bits Referring againto FIG. 1, the master station receives the message and responds to thesync bit by production, at an appropriate time, a timing pulse T7applied to the gate of the REMOTE STATION ADDRESS COMPLEMENT DECODER 20.When the remote station address is decoded, a signal appears on oneoutput of the REMOTE STATION AD- DRESS COMPLEMENT DECODER 20 to enable aPOINT ADDRESS COMPLEMENT DECODER 62 for REMOTE STATION-I. One pointcomplement decoder is associated with the point selection equipment foreach remote station. When the POINT ADDRESS COMPLEMENT DECODER 62 isenabled and a timing pulse T8 is applied, the point address complementiscoupled thereto. Each of a plurality of outputs is responsive to theparticular code group and is connected to a COMPARATOR circuitassociated with each point select switch. A single COMPARATOR circuit isenergized by two signals when the decoded message is actually thecomplement of the remote station and control point addresses generatedby the point select switch. For example, a COMPARATOR circuit 63 isconnected to the POINT ADDRESS COMPLE- MENT DECODER 62 and the latch 31.Therefore, if the point select switch 30 has been depressed and if thedecoded remote station and control point address complements areactually the complements of the point address for PT-l at REMOTESTATION-l, both inputs of the COMPARATOR circuit 63 are energized. Thisindicates that the system is operative.

Similar COMPARATOR circuits 134 and 135 are associated with the pointselection equipment for PT-2 and PT-n respectively. Whenever a singleCOMPARATOR circuit is energized by signals at both inputs, the COMMANDEN- CODER 21 is enabled. This permits subsequent operation of the switch22 or 23 to generate a command code which may then be impressed upon theCOMMON BUSSES 13 by a timing signal T9 for transmission to a POINTCOMMAND DECODER 66 shown in FIG. 2 at the remote station which isresponsive to a timing pulse Till. When the command code is received, asignal is applied to all the command switches simultaneously. As bothinputs of the command switches must be energized simultaneously toactuate a utilization device, only one utilization device is actuated.

In accordance with this invention, therefore, selection of a pointgenerates a digital address which enables one of a plurality utilizationdevice control means. The digital complement of the enabled controlmeans address is generated and transferred by the same logic andcommunications equipment to the selection means. If a system :faultexists, both messages cannot be processed correctly to energize a signalcomparator.

Many circuits utilized in the master station shown in FIG. 1 and theremote station shown in FIG. 2 are well known in the art. For example,the PA-RALLELSERIAL CONVERTERS 14 and 41 and the TRANSCEIVERS and 40 arestandard circuits. Further, many circuit embodiments are adaptedforgenerating and processing complementary codes. However, to facilitate acomplete understanding of this invention, a detailed discussion of aspecific system follows. Tomake this discussion more meaningful, it willbe assumed that the binary address for REMOTE STATION-1 is 10000, whilecontrol points PT-l PT2 and PT-n are address as 10000, 01000 and l l100, respectively so P'T-n is PT-7 assuming that the bits aretransmitted in the order 13,, B B 8,, and B,. These designations areused to identify specific busses, inputs and logic bits in the followingdetailed discussion. Further, it will also be assumed that groundpotential is a logic 0 while a positive potential is logic 1.

Referring to FIGS. 1 and 3, depressing the point select switch 30grounds the input to a NAND circuit 70 which, with another NAND circuit71 constitutes the latch 31. The

resultant logic l on the output'of the NAND circuit 70 is coupled to oneinput of the NAND circ u it 71. The other input is responsive to alogic. 0 reset signal RE. Therefore,- the output of the NAND circuit 71and second input to the NAND circuit '70 are at a logic 0. After thelatch 31 is set, release of the point select switch 30 does not shiftthe latch output from a logic 1. Latches 34 and 36 are similarlyconstructed.

Each latch output is individually connected to one of a plurality ofinputs to the master station POINT ENCODER 32 to generate the pointaddresses 10000, 01000 and 11 100 for I PT-I, PT-2 and PT-7,respectively. The REMOTE STATION I IOOOOXXXXX 10000PPPPP where XXXXXdesignates a binary command character and PPPPP, a parity character.This message is processed by COMMON BUSSES 13 and 42, PARALLEL-SERIALCON- VERTERS 14 and 41 and TRANSCEIVERS 15 and 40.shown in FIGS. 1 and2. Assuming propersystem operation, the latch 47 at REMOTE STATION-1' isenergized by a signal designated as PTSEL-1.

As specifically shown in FIG. 4, the latch 47 includes a NAND circuit 72ergized by P'I'SEL-l and a NAND circuit 72 energized by RE. The outputof the NAND circuit 73 is coupled through a inverter 74 to an NPNtransistor 75 to convert the logic signal to a driving signal. Theemitter 75a is grounded while the collector 75c is directly coupled toone input of the REMOTE POINT COMPLEMENT ENCODER 60. Proper base bias isprovided by a resistor 76 coupling the base 75b to a positive terminal77. The voltage on the collector 750 is supplied from a voltagesource-In the specific embodiment, this bias is supplied from a COMMANDSWITCH FAULT INDICATOR 78 described in detail hereinafter.

When the latch is reset, the output of the NAND circuit 73 goes to logic1 which, after inversion to a logic 0, turns off the transistor 75 sothe input to the POINT COMPLEMENT EN- CODER 60 is logic I. PTSEL-1applies a logic 0 to the NAND circuit 72 and shifts the output of NANDcircuit 73 to logic 0 to turn on the transistor 75 to ground the inputto the POINT I COMPLEMENT ENCODER 60 andenable the COMMAND SWITCH 50.

In accordance with this invention, a REMOTE STATION ADDRESS COMPLEMENTENCODER 61, shown in FIG. 5 with the REMOTE STATION ADDRESS DECODER 45,is energized by the timing pulse T5 to place the complement of theremote station address on the COMMON BUSSES 42. To understand thisspecific embodiment of a remote station address complement encoder, itis necessary to discuss its operation beginning with the command word asit is received from the master station. All characters which appear onthe COM- MON BUSSES 42 are applied in parallel to inverters 80, 81, 82,83 and 84 respectively connected to the B B B 8,, and B, busses. Each ofthe inverters through 84 energizes a NAND circuit, such as NAND circuits85 and 86 associated with the B and B busses. Further, each of theCOMMON BUSSES 42 impresses a signal on a second plurality of NANDcircuits such as NAND circuits 87 and 90. Switches 91 and 92 arerepresentative of selector switches to set the remote station address.This detailed discussion is limited to the circuitry energized by the B,and B busses as this circuitry represents the processing of both logic Iand logic 0 inputs.

Selector switch 91 ground the second input to the NAND -circuit 87 whilethe second input to the NAND circuit 85 floats at logic 1. Therefore,when the 8 bus is a logic I,

NAND circuits 85 and 87 are eachenergized by a logic 1 signal and alogic Osignal so both NAND circuits 85 and 87 go to logic I. Groundingthe second input of the NAND circuit 86 through the selector switch 92causes both outputs of the NAND circuits to go to logic I when the B busis at logic 0. An analysis of the remaining circuitry indicates that theinput to a NAND circuit 93 is at logic I only when a digital message10000 appears on the COMMON BUSSES 42. An output conductor 94 energizedthrough a latch including NAND circuit 95 and '96 is thereforemaintained at a logic 1 if the common input to the NAND circuit 93 is atlogic l hen T3 is generated. Conductor 94 remains at logic 1 until REisapplied to the NAND circuit 96.

The conductor 94 also serves as one input to a plurality of three-inputNAND circuits through 104. A second input is provided from the secondinput of each NAND circuit-in the REMOTE STATION ADDRESS DECODERenergizedby the inverters 80 through 84. Specifically, thesecond inputto the NAND circuit 100 is a logic I because it is not grounded 'by theswitch 91.The second input of the NAND circuit .101 is maintained at alogic 0 signal from the grounded input of the NAND circuit 86.Similarly, second inputs of the NAND circuits 102 through 104 are atlogic 0. Therefore, when timing pulse T5 is applied simultaneously to athird input of all the NAND circuits 100 through 104, a logic 1 isgenerated by the NAND circuits 101, 102, 103 and 104 while the NANDcircuit 100 generates a logic 0. Therefore, the remote station addressis complemented and transmitted as 01 1 l 1.

FIG. 6 illustrates means for generating a digital complement of thepoint address. Latches 47, 52 and 56 are shown in addi tion to a fourthlatch 105, in phantom. Each latch is individually connected to one ormore of a plurality of NAND circuits 110, 111, 112, 113 and 114. Thelatch47 is only connected to the NAND circuit 110; the latch 52, to theNAND circuit 111; the latch 56, to the NAND circuits 110, 111 and 112;and the latch is adapted for connection to the NAND circuits I10 and113. If binary-coded decimal addresses are used, the gate 114 is notenergized so that it always energizes the B, bus with a logic 1. Ifbinary addresses were used, the NAND circuit would be connected tolatches for PT-l6 and above. As previously explained, when a particularlatch is selected, a logic O is generated. The output from the latch 47,in this particular example is, therefore,'a logic 0 while all otherlatches have a logic 1 output. Therefore, the outputs of the gatesthrough 114 will be I, 0, 0, 0 and 0 respectively. These signals areinverted by NAND circuits 115 through 119 when the timing pulse T6 isapplied to produce an output transmitted as 01 l l l which is thecomplement of the binary point address 10000. If latches 52, 56 or 105are selected, point address complements of 10111, 00011 or 01101 aregenerated. Similar logic circuits maybe used to construct the REMOTESTATION ADDRESS AND POINT ENCODERS l7 and 32 shown in FIG. 1.

FIG. 7 is a logic diagram for one embodiment of the REMOTE STATIONADDRESS COMPLEMENT DECODER 20. Assuming REMOTE STATION1 responds to thecommand word, the complemented address 01111 ap pears on the COMMONBUSSES I3. Inverters I20, I21, I22, 123 and 124 are individuallyconnected to the 8,, B B 13,, .and B, busses. One NAND circuit is thenwired to the inverters for each of the remote stations to be responsiveto a correctcomplement and go to logic 0. NAND circuit 125 is wired forREMOTE STATION-1 by being connected to the output of the inverter 120and the inputs of the inverters 121 through 124, When the message 01 l ll is applied with T7. the output of the NAND circuit 125 goes to logicand provides an enabling signal to the POINT ADDRESS COMPLEMENT DECODER62. All the remaining NAND circuits, specifically NAND circuits 126through 128, remain at logic I. If the circuitry processing the B, bitwere defective so that anopen occurred, the returning complementedmessage would be 1 l l l l. The output from the inverter 120 would be alogic 0,

causing the output of the NAND circuit 125 to stay at logic l so thatthe POINT ADDRESS COMPLEMENT DECODER 62 is not enabled. Another NANDcircuit might respond. However, as will be described, such a responsedoes not enable the COMMAND ENCODER 21 in FIG. 1. NAND circuit 126 goesto logic 0 if the address for REMOTE STATION-2, 01000, is complementedto be returned as 101 1 l as all the inputs are connected directly tothe busses with the exception of one input connected to the B busthrough the inverter 12]. The NAND circuit 127 goes to logic 0 when thebusses are energized with 001 l 1, the complement of the address forREMOTE STATION-3. Additional NAND circuits such as NAND circuit 128 maybe wired to the inverters 120 through 124 and the busses to beresponsive to the complement of any given remote station address. i

Whenever one of these NAND circuits, such as the NAND circuit 125, goesto logic 0, it enables one POINT ADDRESS COMPLEMENT DECODER. Forexample, in FIG. 3, the signal from the REMOETATTION ADDRESS COMPLE-MENT DECODER 20, RS-I", in FIG. 1, is applied through an inverter 130 toNAND circuits 131, 132 and 133. Each NA'ND circuit is individuallycoupled through an inverter to one COMPARATOR. Specifically, NANDcircuits 131, I32 and 133 are connected to COMPARATORS 63, 134 and 135through inverters 136, 137 and, 138 respectively. The digital complementof the enabled point address on the COMMON BUSSES 13 is transmittedto'the inputs of the NAND circuits 131 through 133 by a circuitcomprising inverters 140, 141, I42, 143 and 144 individually connectedto the B B B 8,, and B busses, The NAND circuit 131 has its inputsconnected to the inverter 140 and the B B 8,, and B, busses. Its outputgoes to logic 0 with the simultaneous occurrence of the timing pulse T8,the enable signal RS-l and the message 01111. If

the point select switch 30 has been closed, a NAND circuit 145 in theCOMPARATOR 63 goes to logic 0 because the logic 0 output from the NANDcircuit 131 is inverted. All COMPARATOR outputs are coupled together ina common conductor 146 which is pulled to logic 0 to enable the COM-MAND ENCODER 21. Thereafter one of the switches 22 or 23 in FIG. 1 maybe closed to actuate the COMMAND EN- CODER 21 to place another commandword on the COM- MON BUSSES 13. This command word is then transmitted tothe remote stations to energize one of a pair of control transistors toactuate a utilization device, as described more fully hereinafter. I v

To illustrate how an error is detected to prevent operation of animproperly selected device, assume first that system malfunction occursso that when point select switch 30 is closed, REMOTE STATION-2 respondsto PT-I. The REMOTE STATION-2 address, 01000, will be complemented andreturned as 101 l l to energize the REMOTE STATION COM- PLEMENT DECODER20. The address 10111 causes the NAND circuit 126, in FIG. 7, to beenergized. Therefore,'the POINT ADDRESS COMPLEMENT DECODER 62 is notenabled; and, the COMPARATOR 63 is not properly energized to enable theCOMMAND ENCODER 21.

If a failure should occur which disrupts the points address, it isdetected. For example, if a failure occurred in the components so thatthe address for PT1 were received as 01000, latch 52 would be energized.From FIG. 6, it will be evident that the complemented address, 101 1 Iwould be returned and applied to the POINT ADDRESS COMPLEMENT DECODER 62shown in 5&3 simultaneously with the timing pulse T8 and the signal RS-lfrom the REMOTE STATION ADDRESS COMPLEMENT DECODER 20. However, the NANDcircuit 132 would go to logic 0 andencrgize the COM- PARATOR 134. Boththe COMPARATORS 63 and 134 are thereby each energized one input at alogic 1 signal and a logic (1 signal so the conductor I46 remains atlogic I. As a result, COMMAND ENCODER 21 is not enabled.

Therefore, it can be seen by referring to FIGS. 1 and 2 that a completesystems check has been provided using signal rail logic. All thecircuitry from the latch 31 to the latch 47 is involved in thetransmission of the command word andthe generation of a digital addresscomplement. Included are the COMMON BUSSES 13 in the master station andthe COM- MON BUSSES 42 in the remote station. PARALLEL-SERI- ALCONVERTERS 14 and 41 and the TRANSCEIVERS 15 and 40 also process boththe command word and the digital address complement. Therefore, if anyopen or shorted lines exist and a bit passes through the faulty lines,its complement will not be returned for decoding. Hence, the fault isdetected. There is a high degree of assurance that circuit failures willbe sensed by the system and prevent actuation of an incorrectutilization device.

Thereafter, one of the switches 22 or 23in FIG. 1 may be closed toactuate the COMMAND ENCODER 21. A TRIP or CLOSE command is placed on theCOMMON BUSSES 13 with timing pulse T9 and then transferred to the COMMONBUSSES 42 as shown in FIG. 4. The actuation command is received by. thePOINT COMMAND DECODER 66 at a timing pulse T10 to energize a TRIP orCLOSE output. Assuming that the COMMAND switch 50 is enabled, theutilization device is actuated. In the specific illustrated embodiment aTRIP command is decoded to forward bias a transistor 150. The emitter1502 is coupled to the collector 750 by a diode 151, while the collector150C is energized from a positive terminal 152 through a load devicerepresented as a relay coil 153. Similarly a relay coil 154 is energizedin response to a CLOSE command when a transistor 155 is forward biased.The collector 155C is connected through the relay coil 154 to thepositive terminal 152. A diode 156 couples the emitter 155e to thecollector 75c Energization of the relay coil 153 or the relay coil 154causes operation of TRIP contacts 1530 or CLOSE contacts 154aspecifically shown as normally closed and normally open contacts.

Even though employment of the complemented address technique provides acomplete digital information transfer system checkup to the collector75c, two additional failures may not be detected in this specificembodiment. First it is possible for one of the transistors in theCOMMAND SWITCH 50 to be shorted. If this occurred, mere selection andsetting of a latch would energize a utilization device before a systemscheck could be achieved. However, a short circuit would place thevoltage at the terminal 152 on the collector 750. Also connected to thecollector 750 is the COM- MAND SWITCH FAULT INDICATOR 78. It isresponsive to the voltage on terminal 152 to produce an ERROR signal.Many circuits may respond to such an over-voltage. One specific examplewould be a. Zener diode which beaks down if either transistor 150 or15:3 short circuits with the resultant current energizing a means forgenerating the ERROR signal.

A second possible malfunction is'the setting of two latches by selectingone latch while the latching transistor of another is shorted. Asdescribed earlier, some means for forward biasing the latchingtransistors must be provided to enable the latch to be set. In onespecific embodiment, this bias may be provided by a voltage resistivelycoupled to each latching transistor collector, For example, eachcollector could be resistively coupled to a common point; and the commonpoint, to the positive voltage source through a single resistor. Voltagesensing means could then be coupled to the common point. If two or morelatches are energized, then the voltage at the common will decrease eachtime another latch is energized. Means, such as Zener diodes, can alsobe used to sense any decrease at the common point voltage below thatproduced by a single latch. Again, such a decrease couldbe used togenerate the ERROR signal and such a signal could be used to blockselection or actuation. For example, ERROR could'be coupled to somecircuit in the REMOTE STATION COMMON such as the programmer or to thePARALLEL- SERIAL CONVERTER to block further processing of the remotestation and point addresses and also to generate an error; code to betransmitted back to the master station.

By adding some embodiment of a COMMAND SWITCH FAULT INDICATOR 78, acomplete systems check is obtained to assure that proper selection hasoccurred and no malfunctions have occurred in the COMMAND SWITCH.Therefore, in accordance with this invention, high security datatransmission is realized. Actuation of a selection means causes adigital address to be transmitted to enable a utilization device controlmeans. Thereafter, the address of the enabled control means iscomplemented and transmitted back to be compared to the original at theselection means. If the selected and enabled control circuits are thesame, the digital addresses are complementary. Means respond to thissignal to enable a command encoder which, when actuated, sets theutilization device control circuit to its second, or energized Thisdiscussion has been with reference to a specific digital informationtransfer system embodiment especially adapted for use in supervisoryapplications. It will be obvious that this invention is adaptable to anyof the specific system where a high degree of security is required.Further, it will be obvious that the disclosed circuits are illustrativeonly. Many circuit embodiments may be substituted to perform similarfunctions. Therefore, it is the object of the appended'claims to coverall such modifications and variations as come within the true spirit andscope of this invention.

What is new and desired to be secured by Letters Patent of the UnitedStates is:

Iclaim:

I. In a digital information tra nsfer system including a plu- I ishighly secure comprising:

a. address complement generating means responsive to the energization ofone of the control means for generating the digital complement of theenergized control means address;

b. address complement decoding means for producing one of a plurality ofoutputs when anaddress complement is received, said address complementgenerating and decoding means being interconnected by said digitalmessage processing and handling means; and

c. a plurality of systems security indicating means, each of saidindicating means being responsive to simultaneous energization of firstand second inputs to indicate system security, each of said first inputsadapted to be individually connected to and energized by one oftheutilization device selection means and each of said second inputs beingconnected to and energized by the one decoding means output energized byreceipt of said decoding means of the digital complement of the selectedcontrol means, the first and second inputs of a single indicating means,thereby being simultaneously energized when the selected and enabledcontrol means are identical, the first and second inputs of differentsaid indicating means being energized when the selected and enabledcontrol means are different, said security means thereby assuring thatan operative system exists between the control and selection means.

2. A digital information transfer system as recited in claim 1 whereinthe unique digital address contains first and second address characters,said. address complement generating means producing the complement foreach character of the enabled control means address and said addresscomplement decoding means having first and second character decoders,said first character decoder providing an enabling input to said secondcharacter decoder and said second character decoder energizing one ofsaid indicating means second inputs.

3. A digital information transfer system recited in claim 2 wherein thecontrol means are divided into groups, the first address characterdesignating a group and the second character designating a control meansin that group, said first character decoder enabling said secondcharacter decoder whenever any control means in the selected group isenergized.

4. In a supervisory control system including a master station and aplurality ofdigitally addressed remote stations, each of said remotestations having digitally addressed, two-condition actuators adapted tobe enabled by a first signal and energized by a second concurrent signalto control a utilization device and each remote station being connectedto the master station by communication means, means for controlling aspecific utilization device from the master station comprising:

a point selector means at said master station corresponding to eachcontrollable utilization device;

b. digital address generating means responsive to actuation of one ofsaid point selector means for generating'the remote station and actuatoraddresses;

cl master station digital message handling means connected to saiddigital address generating means for transmitting I onto and receivingfrom communication means;

d. remote station digital message handling means for receiving from andtransmitting onto the communication means;

e. remote station address decoder means responsive to receipt of adigital address to enable one specific actuator with the firstenergizing signal,

f. actuator address complement generating means having a plurality ofinputs connected to each actuator to be responsive to the enablingthereof for generating the digital complements of the enabled actuatorand remote station addresses for transmission through said master andremote station digital message handling means and said communicationsmeans;

g. master station decoder means energized by the digital complementshaving aplurality of outputs, one of said outputs being energized inresponse to each digital complement;

h. a plurality of security indicating means, each indicating means beingenergized by one point selector means and the master station decodermeans output energized by the complement of the generated address; and

i. second energizing signal generating means connected to all of saidindicating means to be enabled upon simultaneous energization by a pointselector means and by the master station decoder means and therebypermit actuation of the utilization device.

5. A supervisory control system as recited in claim 4 wherein said pointselector means comprises a latch means having an output connected tosaid digital address generating means and to said security indicatingmeans and switching means for selectively grounding an input of saidlatch means to thereby cause selection of a utilization device controlactuator.

6. A supervisory control system as recited in claim 5 wherein saiddigital address generating means comprises a remote station addressencoder and a plurality of control actuator address encoders, eachcontrol actuator address en coder being associated with all pointselector means for a given remote station and having an outputindividually connected to an input of said remote station addressencoder thereby grounding the latch input causes the control actuatoraddress and a remote station address to be generated'to thereby uniquelydefine a specific utilization device control actuator.

7.' A supervisory control system as recited in claim 6 wherein saidmaster station digital message handling means includes common bussesconnected between circuitry in said master station, a parallel-serialconverter coupled to said common busses and a transceiver connected tosaid parallel-serial converter and said communications means and whereinsaid remote station digital message handling means includes atransceiver connected to said communication means. aparallel-serialconverter connected to said transceiver and remotestation common busses connected to said parallel-serial con verter, allof said common busses, said parallelserial converters, said transceiverand said communication means being operative to handle and process thedigital message and its complement.

8. A supervisory control system as recited in claim 7 wherein thetwocondition actuators include first and second serially connectedswitching means and a latch adapted for energization by the first signaland connected to said remote point address complement encoder forcausing the energization thereof.

9. A supervisory control; system as recited in claim 7 wherein saidactuator address complement generating means includes a remote stationaddressdigital complement encoder and an actuator address digitalcomplement encoder, said remote station address digital complementencoder being energized by said remote station address decoder and saidpoint address complement encoder being energized by energization of saidactuator latch.

10. A supervisory control system as recited in claim 9 wherein saidmaster station decoder means includes a remote station address digitalcomplement decoder and a plurality of actuator address digitalcomplement encoders, receipt of said remote station address digitalcomplement at said master station enabling one of said actuator addressdigital complement decoders.

ll. A supervisory control system as recited in claim 10 wherein saidsecurity indicating means are constituted by a plurality of comparatorcircuits, each of said comparator circuits being individually connectedto one of said point selector latch means and one of said actuatoraddress digital complement decoder outputs.

12. A supervisory control system as recited in claim 11 wherein saidsecond energizing signal generating means includes command encoder meansconnected to all of said comparator outputs to be enabled when one ofsaid comparator outputs is energized, said command encoder additionallyincluding actuation selection means and means for generating a commandcode onto said common busses for transmission to the remote station andmeans responsive to said command message for decoding said message andenergizing all of said twocondition actuators with the second energizingsignal whereby only one of said actuators is energized by both saidsecond and first energizing signals.

13. A supervisory control system as recited in claim 5 wherein saidactuators and said point selector means are grouped according to remotestation and wherein a plurality of said actuators may have the sameactuator address, each of said remote stations having a uniflue addressso that the combination of said remote station a dress and said actuatoraddress define a specific actuator, each of said groups having a singleactuator address complement generating means responsive to theenergization of said latch means for generating the actuator addressdigital complement and simultaneously energizing one input to a remotestation address complement encoder to generate the appropriate remotestation address digital complement.

14. A supervisory control system as recited in claim 13 additionallyincluding means for monitoring the two-condition actuator for respondingto a fault therein to thereby prohibit system operation.

i. gnunu E E Q Patent No. 3 577 187 lph A. Benson Inventofls) Ra theabova-Mentifieri paterr is certified that error appeal??? in and thatsaid Letters Patent hereby CDTIEC m below ted as Shaw delete arterColumn 2 line line 32,

. Cc um'n ii-Sli Column 4-,

"rality", insert after addresse anoul.

y d 6) i U n O m .n u ,5

Line 17,

w as Is,

' gnidan L: h

FORM Pcwicau L LO-o1JJ

1. In a digital information transfer system including a plurality ofaddressed, energizable utilization device control means, a plurality ofutilization device selection means, digital message generating means forproducing a unique digital address upon actuation of each selectionmeans, digital message processing and handling means and decoding meansresponsive to receipt of a digital address for enabling one of thecontrol means, the improvement of means for assuring the system ishighly secure comprising: a. address complement generating meansresponsive to the energization of one of the control means forgenerating the digital complement of the energized control meansaddress; b. address complement decoding means for producing one of aplurality of outputs when an address complement is received, saidaddress complement generating and decoding means being interconnected bysaid digital message processing and handling means; and c. a pluralityof systems security indicating means, each of said indicating meansbeing responsive to simultaneous energization of first and second inputsto indicate system security, each of said first inputs adapted to beindividually connected to and energized by one of the utilization deviceselection means and each of said second inputs being connected to andenergized by the one decoding means output energized by receipt of saiddecoding means of the digital complement of the selected control means,the first and second inputs of a single indicating means, thereby beingsimultaneously energized when the selected and enabled control means areidentical, the first and second inputs of different said indicatingmeans being energized when the selected and enabled control means aredifferent, said security means thereby assuring that an operative systemexists between the control and selection means.
 2. A digital informationtransfer system as recited in claim 1 wherein the unique digital addresscontains first and second address characters, said address complementgenerating means producing the complement for each character of theenabled control means address and said address complement decoding meanshaving first and second character decoders, said first character decoderproviding an enabling input to said second character decoder and saidsecond character decoder energizing one of said indicating means secondinputs.
 3. A digital information transfer system as recited in claim 2wherein the control means are divided into groups, the first addresscharacter designating a group and the second character designating acontrol means in that group, said first cHaracter decoder enabling saidsecond character decoder whenever any control means in the selectedgroup is energized.
 4. In a supervisory control system including amaster station and a plurality of digitally addressed remote stations,each of said remote stations having digitally addressed, two-conditionactuators adapted to be enabled by a first signal and energized by asecond concurrent signal to control a utilization device and each remotestation being connected to the master station by communication means,means for controlling a specific utilization device from the masterstation comprising: a. point selector means at said master stationcorresponding to each controllable utilization device; b. digitaladdress generating means responsive to actuation of one of said pointselector means for generating the remote station and actuator addresses;c. master station digital message handling means connected to saiddigital address generating means for transmitting onto and receivingfrom communication means; d. remote station digital message handlingmeans for receiving from and transmitting onto the communication means;e. remote station address decoder means responsive to receipt of adigital address to enable one specific actuator with the firstenergizing signal; f. actuator address complement generating meanshaving a plurality of inputs connected to each actuator to be responsiveto the enabling thereof for generating the digital complements of theenabled actuator and remote station addresses for transmission throughsaid master and remote station digital message handling means and saidcommunications means; g. master station decoder means energized by thedigital complements having a plurality of outputs, one of said outputsbeing energized in response to each digital complement; h. a pluralityof security indicating means, each indicating means being energized byone point selector means and the master station decoder means outputenergized by the complement of the generated address; and i. secondenergizing signal generating means connected to all of said indicatingmeans to be enabled upon simultaneous energization by a point selectormeans and by the master station decoder means and thereby permitactuation of the utilization device.
 5. A supervisory control system asrecited in claim 4 wherein said point selector means comprises a latchmeans having an output connected to said digital address generatingmeans and to said security indicating means and switching means forselectively grounding an input of said latch means to thereby causeselection of a utilization device control actuator.
 6. A supervisorycontrol system as recited in claim 5 wherein said digital addressgenerating means comprises a remote station address encoder and aplurality of control actuator address encoders, each control actuatoraddress encoder being associated with all point selector means for agiven remote station and having an output individually connected to aninput of said remote station address encoder thereby grounding the latchinput causes the control actuator address and a remote station addressto be generated to thereby uniquely define a specific utilization devicecontrol actuator.
 7. A supervisory control system as recited in claim 6wherein said master station digital message handling means includescommon busses connected between circuitry in said master station, aparallel-serial converter coupled to said common busses and atransceiver connected to said parallel-serial converter and saidcommunications means and wherein said remote station digital messagehandling means includes a transceiver connected to said communicationmeans, a parallel-serial converter connected to said transceiver andremote station common busses connected to said parallel-serialconverter, all of said common busses, said parallel-serial converters,said transceiver and said communication means being operative to handleand process the dIgital message and its complement.
 8. A supervisorycontrol system as recited in claim 7 wherein the two-condition actuatorsinclude first and second serially connected switching means and a latchadapted for energization by the first signal and connected to saidremote point address complement encoder for causing the energizationthereof.
 9. A supervisory control system as recited in claim 7 whereinsaid actuator address complement generating means includes a remotestation address digital complement encoder and an actuator addressdigital complement encoder, said remote station address digitalcomplement encoder being energized by said remote station addressdecoder and said point address complement encoder being energized byenergization of said actuator latch.
 10. A supervisory control system asrecited in claim 9 wherein said master station decoder means includes aremote station address digital complement decoder and a plurality ofactuator address digital complement encoders, receipt of said remotestation address digital complement at said master station enabling oneof said actuator address digital complement decoders.
 11. A supervisorycontrol system as recited in claim 10 wherein said security indicatingmeans are constituted by a plurality of comparator circuits, each ofsaid comparator circuits being individually connected to one of saidpoint selector latch means and one of said actuator address digitalcomplement decoder outputs.
 12. A supervisory control system as recitedin claim 11 wherein said second energizing signal generating meansincludes command encoder means connected to all of said comparatoroutputs to be enabled when one of said comparator outputs is energized,said command encoder additionally including actuation selection meansand means for generating a command code onto said common busses fortransmission to the remote station and means responsive to said commandmessage for decoding said message and energizing all of saidtwo-condition actuators with the second energizing signal whereby onlyone of said actuators is energized by both said second and firstenergizing signals.
 13. A supervisory control system as recited in claim5 wherein said actuators and said point selector means are groupedaccording to remote station and wherein a plurality of said actuatorsmay have the same actuator address, each of said remote stations havinga unique address so that the combination of said remote station addressand said actuator address define a specific actuator, each of saidgroups having a single actuator address complement generating meansresponsive to the energization of said latch means for generating theactuator address digital complement and simultaneously energizing oneinput to a remote station address complement encoder to generate theappropriate remote station address digital complement.
 14. A supervisorycontrol system as recited in claim 13 additionally including means formonitoring the two-condition actuator for responding to a fault thereinto thereby prohibit system operation.